Re: parser/generator for keepalived.conf

On 30.06.2014, C.J. Adams-Collier KF7BMP wrote:
> I've got a project on my plate to automate and reduce the human error in
> adding new VLANs, subnets, addresses, etc. to our production firewall
> fleet.  Today, we manually make modifications to the following on both
> members of the VRRP pair:
> 
> * /etc/conf.d/net.ext
> * /etc/conf.d/net.int
> * /etc/keepalived/keepalived.conf
> * quagga OSPF running-config
> 
> This leaves a lot of room for error.  And occasionally, we let a thing
> or two slip by us.  This causes us enough headache to put some time and
> energy in to improving the process.
> 
> Which brings me to the question, does there exist a parser/generator for
> the keepalived.conf file?  If not, would you like me to contribute my
> work on the generator, and would one of you point me to the parser?

Been there, done that :-)

We ran into a similar issues during loadbalancer configuration, and solved
it the other way around - by automatically creating configurations.

-An abstracted configuration file per balancer is being edited; in our case, 
 this is JSON, while nowadays I'd prefer YAML (easier to read, less error-prone).
 As parsable configuration, this may be edited automatically, e.g. by an 
 abstracted service, some GUI or a module in some scripting engine like Puppet.
 This configuration file is submitted to a svn repository.

-A separate application does check out the submitted JSON configuration
 and uses template toolkit to create matching configurations for
 keepalived and quagga.
 The results are submitted to a different svn repository.

-A distribution system (e.g. Puppet, Chef, ...) does check out the distribution 
 repository and send the configurations to the actual load balancers into a 
 seperate directory on every load balancer node.

 A graceful reload of one loadbalancer at a time is initiated: 
 -obtain a lock for the reload
 -backup the previous configuration
 -install new configuration
 -reload one loadbalancer node at a time, only on inactive nodes.

  For active/passive pairs, the passive node is being reloaded
  first, a graceful failover is initiated, then the previously 
  active node is being reloaded and a graceful takeover initiated.
  For active/active setups or anycasted services, the bgp announcement 
  of one host at a time is taken down, the reload iniitated and after
  successfull reload the bgp announcement is re-installed.
 -if something breaks during reload, revert to the previous 
  configuration and send an alarm.



The "original" JSON-configuration file is completely machine-readable,
so depending on ones infrastructure, this process can be quite easily extended:
-automatically complete this configuration from a separate module for
 puppet/chef/... which also ensures the correct VIPs to be configured 
 on all realservers.
-interface a GUI to this configuration
-check if the VIP address and realservers are part of networks who are to
 be handled by that loadbalancer
-check if the same VIP address is used by multiple loadbalancers at the same
 time, who don't belong to the same node group.
-check any (network) firewall restrictions regarding the VIP address to
 prevent announcing an in-accessible service
-check if IPv4 and IPv6 are handled by the same or different loadbalancer
 pairs - whatever matches one's policy.
-check if the used IP addresses are properly assigned in your IP address
 management system and they do have correct reverse DNS configured.




Anders
-- 
1&1 Internet AG              Expert Systems Architect (IT Operations)
Brauerstrasse 50             v://49.721.91374.0
D-76135 Karlsruhe            f://49.721.91374.225

Amtsgericht Montabaur HRB 6484
Vorstand: Ralph Dommermuth, Frank Einhellinger, Robert Hoffmann, 
Andreas Hofmann, Markus Huhn, Hans-Henning Kettler, Uwe Lamnek, 
Jan Oetjen, Christian Würst
Aufsichtsratsvorsitzender: Michael Scheeren

------------------------------------------------------------------------------
Open source business process management suite built on Java and Eclipse
Turn processes into business applications with Bonita BPM Community Edition
Quickly connect people, data, and systems into organized workflows
Winner of BOSSIE, CODIE, OW2 and Gartner awards
http://p.sf.net/sfu/Bonitasoft